Cybercriminals Exploit BNB Chain for Malware Distribution via Fake CAPTCHAs

Summary

• Cybercriminals are utilizing BNB Smart Chain contracts to disseminate malware.
• Fraudulent CAPTCHA notifications instruct users to enter harmful commands into Windows utilities.
• Successful breaches can lead to credential theft and prolonged access to corporate networks.

According to a report by Microsoft Threat Intelligence, cybercriminals are leveraging BNB Chain contracts to propagate malware through compromised websites and counterfeit CAPTCHA prompts.

In a post on X this Thursday, Microsoft Threat Intelligence revealed that this operation employs EtherHiding, a method that conceals malicious commands within a blockchain smart contract. JavaScript injected into compromised sites communicates with a BNB Chain gateway to fetch commands from a contract associated with ClearFake, a malware initiative targeting legitimate websites.

By storing these malicious instructions on a blockchain, they become more challenging to eliminate. Only the wallet managing the contract has the authority to modify its contents, which diminishes the efficacy of traditional takedown efforts.

Users visiting compromised websites encounter a fraudulent CAPTCHA that instructs them to access the Windows Run dialog, paste text from their clipboard, and hit Enter. This action executes a command provided by the attacker.

This technique, referred to as ClickFix, relies on victims unwittingly executing the malware. A variant known as TerminalFix directs users to use Windows Terminal or PowerShell.

“This campaign illustrates that ClickFix and TerminalFix are highly prevalent initial access strategies,” noted Microsoft researchers. “Microsoft observes campaigns affecting thousands of enterprise and consumer devices worldwide on a daily basis, while certain malvertising networks can direct users to scam sites.”

Microsoft further stated that hackers conceal their commands and exploit legitimate Windows tools such as PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. A successful infection can compromise passwords, establish ongoing access, facilitate lateral movement across a network, and potentially lead to ransomware attacks or extensive network breaches.

The utilization of blockchains in malware activities is not a novel concept.

In 2016, Cerber ransomware began utilizing Bitcoin transactions to locate its command-and-control servers. From 2019 to 2021, the Glupteba botnet took advantage of the Bitcoin blockchain to find backup servers when its primary servers went offline.

In September 2023, the ClearFake malware campaign started employing EtherHiding to fetch malicious code from BNB Chain smart contracts. Additionally, in April 2026, researchers discovered Omnistealer using TRON, Aptos, and BNB Chain to aid in the theft of credentials, cloud account details, passwords, and cryptocurrency wallet information.

This issue is not exclusive to BNB Chain, yet it is significant that Microsoft’s threat team has chosen to emphasize what seems to be a persistent problem.

This revelation follows BNB Chain's announcement in July regarding plans for a new layer-1 blockchain designed for high-frequency trading, automated payments, and AI-driven transactions, with a testnet anticipated by late 2026 and a mainnet launch in early 2027.

Microsoft recommends that organizations limit unnecessary command-line tools, enable PowerShell logging, and implement application controls.

“Users should avoid pasting commands from CAPTCHAs, browser errors, emails, advertisements, or unsolicited support pages into Run, Terminal, PowerShell, or Command Prompt,” Microsoft advised.